WS
Product
WP Statistics
24
CVEs
0
On KEV
9.8
Max CVSS
2
New 30D
Severity mix
Critical 3High 10Medium 11Low 0
Watch
Add WP Statistics to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-25148 | 9.8 | Feb 24 | The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the current_page_id parameter found in the… Affected: through 13.1.5 |
| CVE-2017-18515 | 9.8 | Aug 14 | The wp-statistics plugin before 12.0.8 for WordPress has SQL injection Affected: before 12.0.8 |
| CVE-2019-13275 | 9.8 | Jul 4 | An issue was discovered in the VeronaLabs wp-statistics plugin before 12.6.7 for WordPress Affected: through 12.6.6 |
| CVE-2023-0955 | 8.8 | Mar 27 | The WP Statistics WordPress plugin before 14.0 does not escape a parameter, which could allow authenticated users to perform SQL Injection attacks Affected: before 14.0 |
| CVE-2022-38074 | 8.8 | Mar 13 | SQL Injection vulnerability in VeronaLabs WP Statistics plugin <= 13.2.10 versions Affected: before 13.2.11 |
| CVE-2022-4230 | 8.8 | Jan 23 | The WP Statistics WordPress plugin before 13.2.9 does not escape a parameter, which could allow authenticated users to perform SQL Injection attacks Affected: before 13.2.9 |
| CVE-2022-25149 | 7.5 | Feb 24 | The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the IP parameter found in the… Affected: through 13.1.5 |
| CVE-2022-0651 | 7.5 | Feb 24 | The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the current_page_type parameter found in the… Affected: through 13.1.5 |
| CVE-2022-0513 | 7.5 | Feb 16 | The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the exclusion_reason parameter found in the… Affected: through 13.1.4 |
| CVE-2021-24340 | 7.5 | Jun 7 | The WP Statistics WordPress plugin before 13.0.8 relied on using the WordPress esc_sql() function on a field not delimited by quotes and did not first prepare the query Affected: before 13.0.8 |
| CVE-2026-97276 | 7.1 | Oct 4 | WordPress WP Statistics plugin <= 14.16.14 - Cross Site Scripting (XSS) vulnerability Affected: through 14.16.14 |
| CVE-2026-93770 | 7.1 | Sep 30 | WordPress WP Statistics plugin <= 14.16.13 - Cross Site Scripting (XSS) vulnerability Affected: through 14.16.13 |
| CVE-2026-48839 | 7.1 | Jun 1 | WordPress WP Statistics plugin <= 14.16.6 - Cross Site Scripting (XSS) vulnerability Affected: through 14.16.6 |
| CVE-2021-4333 | 6.5 | Mar 7 | The WP Statistics plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 13.1.1 Affected: through 13.1.1 |
| CVE-2026-84774 | 6.1 | Sep 3 | WordPress WP Statistics plugin <= 14.16.11 - Cross Site Scripting (XSS) vulnerability Affected: through 14.16.11 |
| CVE-2022-27231 | 6.1 | Jun 13 | Cross-site scripting vulnerability exists in WP Statistics versions prior to 13.2.0 because it improperly processes a platform parameter Affected: before 13.2.0 |
| CVE-2022-1005 | 6.1 | Jun 8 | The WP Statistics WordPress plugin before 13.2.2 does not sanitise the REQUEST_URI parameter before outputting it back in the rendered page, leading to Cross-Site Scripting (XSS)… Affected: before 13.2.2 |
| CVE-2022-25307 | 6.1 | Feb 24 | The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the platform parameter found in the… Affected: through 13.1.5 |
| CVE-2022-25306 | 6.1 | Feb 24 | The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the browser parameter found in the… Affected: through 13.1.5 |
| CVE-2022-25305 | 6.1 | Feb 24 | The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the IP parameter found in the… Affected: through 13.1.5 |
| CVE-2019-10864 | 6.1 | Apr 23 | The WP Statistics plugin through 12.6.2 for WordPress has XSS, allowing a remote attacker to inject arbitrary web script or HTML via the Referer header of a GET request Affected: through 12.6.2 |
| CVE-2018-1000556 | 6.1 | Jun 26 | WordPress version 4.8 + contains a Cross Site Scripting (XSS) vulnerability in plugins.php or core wordpress on delete function that can result in An attacker can perform client… Affected: before 12.0.6 |
| CVE-2019-12566 | 5.4 | Jun 3 | The WP Statistics plugin through 12.6.5 for Wordpress has stored XSS in includes/class-wp-statistics-pages.php Affected: through 12.6.5 |
| CVE-2025-55716 | 4.3 | Aug 14 | WordPress WP Statistics Plugin <= 14.15 - Broken Access Control Vulnerability Affected: through 14.15 |
Showing 24